a hipaa authorization has which of the following characteristics